package cn.edu.szu.bigdata.secure;


import cn.edu.szu.bigdata.util.ConfigUtil;
import com.qihoo.wzws.rzb.secure.po.AttackEntity;
import com.qihoo.wzws.rzb.secure.po.LogEntity;
import com.qihoo.wzws.rzb.util.MD5Builder;
import com.qihoo.wzws.rzb.util.UAUtils;
import java.text.DateFormat;
import java.text.SimpleDateFormat;
import java.util.Date;
import java.util.Iterator;

public class AttackAnalyzeSingle {
    public AttackAnalyzeSingle() {
    }

    public void execute(LogEntity log) {
        long start = System.currentTimeMillis();
        if (log != null) {
            AttackReportCache.records.incrementAndGet();
            String remote_addr = log.getIp();
            String time_local = log.getTime();
            String host = log.getHost();
            String request_uri = log.getRequestUrl();
            String status = log.getResponseCode();

            try {
                String[] ritems;
                label208: {
                    String xingtu_httpcode_particular;
                    String[] xingtu_httpcode_particulars;
                    boolean isContains;
                    int len$;
                    int i$;
                    String s;
                    switch ((Integer)ConfigUtil.m_config.get("xingtu_pagetype")) {
                        case 1:
                        default:
                            break;
                        case 2:
                            if (request_uri.contains(".html") || request_uri.contains(".js") || request_uri.contains(".css") || request_uri.contains(".jpg") || request_uri.contains(".png") || request_uri.contains(".gif")) {
                                return;
                            }
                            break;
                        case 3:
                            xingtu_httpcode_particular = ConfigUtil.formatConfig.get("xingtu_pagetype_particular");
                            if (xingtu_httpcode_particular != null && xingtu_httpcode_particular.length() >= 3) {
                                xingtu_httpcode_particulars = xingtu_httpcode_particular.split(",");
                                isContains = false;
                                ritems = xingtu_httpcode_particulars;
                                len$ = xingtu_httpcode_particulars.length;

                                for(i$ = 0; i$ < len$; ++i$) {
                                    s = ritems[i$];
                                    if (request_uri.contains(s)) {
                                        isContains = true;
                                        break;
                                    }
                                }

                                if (!isContains) {
                                    return;
                                }
                            } else if (!request_uri.contains(".php") && !request_uri.contains(".aspx")) {
                                return;
                            }
                    }

                    switch ((Integer)ConfigUtil.m_config.get("xingtu_httpcode")) {
                        case 1:
                        default:
                            break label208;
                        case 2:
                            if (!status.equals("200")) {
                                return;
                            }
                            break label208;
                        case 3:
                    }

                    xingtu_httpcode_particular = ConfigUtil.formatConfig.get("xingtu_httpcode_particular");
                    if (xingtu_httpcode_particular != null && xingtu_httpcode_particular.length() >= 3) {
                        xingtu_httpcode_particulars = xingtu_httpcode_particular.split(",");
                        isContains = false;
                        ritems = xingtu_httpcode_particulars;
                        len$ = xingtu_httpcode_particulars.length;
                        i$ = 0;

                        while(true) {
                            if (i$ < len$) {
                                s = ritems[i$];
                                if (!status.contains(s)) {
                                    ++i$;
                                    continue;
                                }

                                isContains = true;
                            }

                            if (!isContains) {
                                return;
                            }
                            break label208;
                        }
                    } else if (!status.equals("302") && !status.equals("502")) {
                        return;
                    }
                }

                switch (ConfigUtil.m_config.get("xingtu_urltype")) {
                    case 1:
                    default:
                        break;
                    case 2:
                        if (!request_uri.contains("?")) {
                            return;
                        }
                        break;
                    case 3:
                        if (request_uri.contains("?")) {
                            return;
                        }
                }

                if (request_uri.length() >= 512) {
                    ReportOutput.writeFile(new String(host + "\t" + "超长URL" + "\t" + remote_addr + "\t" + request_uri + "\t" + time_local + "\t" + status + "\t" + 1));
                    AttackReportCache.longUrlCount.incrementAndGet();
                    return;
                }

                if (AnalyzeSingle.useCC && AttackReportCache.records.get() > 0L && AttackReportCache.records.get() % 500000L == 0L) {
                    System.gc();
                }

                DateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
                Iterator iter = ConfigUtil.rules.iterator();

                label199:
                while(true) {
                    if (!iter.hasNext()) {
                        if (log.getUa() == null) {
                            break;
                        }

                        String ua = log.getUa();
                        iter = UAUtils.uaList.iterator();

                        String feature;
                        do {
                            if (!iter.hasNext()) {
                                break label199;
                            }

                            feature = (String)iter.next();
                        } while(!ua.contains(feature));

                        AttackEntity entity = new AttackEntity(host, "非法UA", remote_addr, request_uri, time_local, status, 1);
                        AttackReportCache.put2AttMap(MD5Builder.getMD5String(new String(host + remote_addr + request_uri + time_local + status)), entity);
                        AttackReportCache.attackCount.incrementAndGet();
                        AttackReportCache.put2OverViewMap("非法UA");
                        return;
                    }

                    String rule = (String)iter.next();
                    ritems = rule.split(":", 2);
                    if (ritems.length == 2) {
                        String rname = ritems[0];
                        String rfeatures = ritems[1];
                        String[] features = rfeatures.split("\\|");
                        String[] arr$ = features;
                        int len$ = features.length;

                        for(int i$ = 0; i$ < len$; ++i$) {
                            String feature = arr$[i$];
                            if (request_uri.contains(feature)) {
                                AttackEntity entity = new AttackEntity(host, rname, remote_addr, request_uri.replaceAll("&", "&amp;").replaceAll(">", "&gt;").replaceAll("<", "&lt;").replaceAll("\"", "&quot;"), time_local, status, 1);
                                AttackReportCache.put2AttMap(MD5Builder.getMD5String(new String(host + remote_addr + request_uri.replaceAll("&", "&amp;").replaceAll(">", "&gt;").replaceAll("<", "&lt;").replaceAll("\"", "&quot;") + time_local + status)), entity);
                                if (AnalyzeSingle.useRoutine) {
                                    AttackReportCache.attackCount.incrementAndGet();
                                    AttackReportCache.put2OverViewMap(rname);
                                    String[] day = time_local.split(" ");
                                    String[] hour = time_local.split(":");
                                    AttackReportCache.put2dayAttackMap(day[0]);
                                    AttackReportCache.put2hourAttackMap(hour[0]);
                                    Date attacktime = dateFormat.parse(time_local);
                                    if (AttackReportCache.startTime == null || AttackReportCache.startTime.after(attacktime)) {
                                        AttackReportCache.startTime = attacktime;
                                        AttackReportCache.firstAttack = entity;
                                    }

                                    if (AttackReportCache.endTime == null || AttackReportCache.endTime.before(attacktime)) {
                                        AttackReportCache.endTime = attacktime;
                                    }
                                }

                                return;
                            }
                        }
                    }
                }
            } catch (Exception var24) {
                var24.printStackTrace();
                return;
            }

            long then = System.currentTimeMillis();
        }
    }
}
